Aqua Security, Lacework, RAD Security and Sysdig

About Lacework

Lacework is a cloud security services provider that automates cloud security at scale for cloud and container workloads. Lacework's platform uses machine learning to detect anomalies across multi-cloud environments and prioritizes alerts for security teams, reducing the volume of alerts that analysts must review manually.^[2]

About RAD Security

RAD Security sells AI Workers that investigate, triage, and act on threats across a customer's entire stack. RAD Security describes its AI Workers as purpose-built agents that triage, route, and act, with every action traceable and every decision explainable. RAD Security connects security tools through an MCP server and 50+ integrations that form a single data fabric. Integrations in the RAD Security platform ingest alerts, logs, and findings that are timestamped and source-tagged. RAD Security analyzes, correlates, and enriches every signal against live runtime context.^{[1][2][4][5][6]}

RAD Security's cloud security posture view covers AWS, GCP, Azure, and Linode and displays misconfigured resources, IAM issues, and compliance status. RAD Security's Kubernetes security posture view covers cluster misconfigurations, RBAC issues, and CIS Benchmark scoring. RAD Security's runtime security monitoring shows runtime threats and behavioral anomalies detected by eBPF sensors across all clusters. RAD Security's software supply chain view covers SBOM coverage, dependency vulnerabilities, and package provenance.^[2][5]

RAD Security deploys lightweight eBPF-based agents that collect runtime signals. RAD Security's sensors continuously discover and track every asset in a Kubernetes environment, including containers, images, workloads, network connections, process executions, and their relationships to each other. RAD Security streams Kubernetes API events and tracks resource creation, modification, and deletion as they happen. RAD Security's image scanning is continuous, detects CVEs, and generates software bills of materials. RAD Security includes an admission controller that catches policy violations before they reach clusters.^[4][6][7]

RAD Bot is an AI agent with direct access to a customer's live environment data through three connected layers. RAD Bot queries a customer's live environment, correlates the results, and delivers findings with full source attribution. RAD Bot connects to Jira, Slack, ServiceNow, and email so users can escalate, assign, and remediate without leaving the conversation. RAD Bot can query data from EDR, SIEM, vulnerability scanners, and ticketing systems through a single conversation. RAD Bot covers AWS CloudTrail activity, cloud posture findings, and identity and access signals from Okta, Entra ID, and Google Workspace. RAD Bot automatically searches the Knowledge Base for relevant context and cites sources in every answer. RAD Security's Knowledge Base accepts PDFs, Markdown, CSVs, or plain text. RAD Bot workflows run multi-step investigations automatically and deliver results to an inbox, Slack, email, or ticketing system.^[7][8]

RADQL is a SQL-like query language built for security data. RADQL is included with every RAD Security deployment. RADQL queries span containers, vulnerabilities, runtime events, cloud resources, and identity signals with a single, consistent schema. RADQL results can be exported to CSV or JSON. RAD Security offers 9 pre-built dashboard templates covering findings, containers, runtime, and compliance. RAD Security dashboards can track misconfigurations mapped to NIST 800-53 controls with compliance scores.^[9][11]

The Evidence Room in RAD Security aggregates vulnerabilities, misconfigurations, runtime threats, and attack paths into a single prioritized view. In the Evidence Room, findings are automatically mapped to compliance frameworks such as CIS, SOC 2, PCI-DSS, and NIST for audit readiness. Evidence Room findings flow into existing tools so that users can create tickets, alert teams, and export to a SIEM. RAD Security provides audit-ready compliance documentation for CIS, PCI-DSS, SOC2, HIPAA, and NSA Hardening frameworks.^[2][5][12]

AI Insights in RAD Security continuously analyzes a cloud-native environment and surfaces what matters most. AI Insights rankings are based on exploitability, blast radius, business context, and attack path relevance. AgentKeeper is RAD Security's open-source tool that maps a cloud identity attack surface. RAD Security states that its infrastructure is SOC 2 Type 2 certified.^{[2][3][5][6][7][8][9][10][11][12][13][14]}

About Sysdig

Sysdig delivers real-time defense for cloud, containers, and AI agents. Sysdig captures live system calls at the kernel level, which shows what is actually running in the cloud.^[3]

Sysdig offers an agentless approach that provides visibility into cloud security posture, covering vulnerabilities, misconfigurations, in-use permissions, and threats. Sysdig delivers real-time threat detection across workloads, identities, cloud services, and third-party apps by combining drift control, machine learning, and Falco rules curated by the Sysdig Threat Research Team. Cloud Attack Graph correlates assets, activity, and risks across domains to uncover hidden attack paths and accelerate incident detection and response. Sysdig combines runtime insights, such as in-use vulnerabilities and in-use permissions, with static assessments, including misconfigurations and known security flaws, to generate a prioritized list of the riskiest findings.^[1][5][6]

Sysdig uses a graph model that continuously ingests and correlates data from cloud APIs, configurations, identity permissions, and runtime insights. Sysdig maintains an inventory of cloud resources, enriched with compliance violations, vulnerabilities, and IAM misconfigurations. For workloads, Sysdig detects workload and container threats in real time with out-of-the-box detection rules, powered by Falco and curated by the Threat Research Team. For vulnerabilities, Sysdig prioritizes vulnerabilities tied to in-use packages, enriched with context like exploitability, exposure, and asset criticality. CVE360 offers a complete picture of each vulnerability, including its source, affected resources, and how to fix it. Sysdig identifies high-impact fixes at the source, such as a patch to a base image that resolves dozens of downstream vulnerabilities. Sysdig Sage provides AI-powered remediation guidance with step-by-step instructions in natural language.^[6][7][8]

Sysdig delivers real-time detection across Linux and Windows servers, containers and Kubernetes, cloud logs and trails, and Serverless (FaaS). Sysdig correlates identity activity patterns with workload exploits to detect compromised identities and stop attacks at the first sign of privilege escalation and account compromise. Sysdig server threat detection starts with a lightweight agent, fueled by the Falco detection engine. The Sysdig agent streams kernel-level events, cloud service logs, and Kubernetes metadata in real time. For infrastructure as code, Sysdig automatically scans infrastructure code during development to detect misconfigurations, policy violations, and vulnerabilities in Terraform, CloudFormation, Kubernetes manifests, and other IaC templates before they reach production. Sysdig enforces security standards directly in the development workflow using OPA-based policies.^[9][10][11]

The Sysdig GenAI Assistant, formerly Sysdig Sage, is powered by an autonomous agents architecture and employs multi-step reasoning and contextual awareness. The Sysdig GenAI Assistant can respond to user queries on cloud detection and response, posture management, and vulnerability management. The Sysdig GenAI Assistant is available as a conversational assistant and embedded directly into the UI. Secure AI extends the Sysdig Secure platform with an expert AI security team. Secure AI can run inside the agents a team already uses, take on the work, or answer questions along the way. Sysdig connects its platform to the AI agents a team already uses through curated agent skills and an MCP server. Sysdig Secure lets users define desired outcomes while autonomous agents handle the work.^[3][12]

Sysdig Monitor provides visibility into Kubernetes clusters, namespaces, workloads, pods, and containers, regardless of cloud platform. Sysdig Monitor collects metrics about an environment, then correlates and enriches those metrics. Sysdig grew out of open source and supports open standards. The Sysdig Threat Research Team monitors emerging attacker behaviors and cloud-native threats and turns real-world insights into actionable detections. Sysdig's Threat Research Team has spent years uncovering novel cloud attacks, from JADEPUFFER to SCARLETEEL.^{[1][3][13][14]}

Sysdig describes a product for defending Kubernetes, containers, and hosts in on-premises, air-gapped, and private cloud environments. Sysdig cloud detection and response is designed to provide advanced capabilities across multi-cloud, hybrid, and on-premises infrastructures. The security and engineering teams at BigCommerce use Sysdig to identify and eliminate misconfigurations and streamline compliance. Neo4j needed a cloud security platform that provided unified coverage across its cloud environment. Apree Health uses Sysdig for security and incident response and for visibility into its Kubernetes deployment.^{[3][5][6][7][8][10][11]}